18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- GLBA and the NAIC privacy model protect nonpublic financial (NPI) and health information; financial sharing uses opt-out, health sharing generally uses opt-in.
- FCRA requires applicant notice and an adverse-action notice whenever a consumer or credit report contributes even partly to a declination, higher premium, or reduced coverage.
- Hard fraud fabricates a loss; soft fraud pads a real claim; 18 U.S.C. 1033/1034 bars persons convicted of dishonesty felonies from insurance without regulator consent.
- Free-look periods (commonly 10-30 days) let consumers return a new policy for a full refund.
- Guaranty associations pay covered claims up to caps if an insurer is insolvent, are funded by assessments on solvent insurers, and may not be used as a sales inducement.
The Privacy Framework: GLBA and the NAIC Model
Insurers and producers handle highly sensitive data, so federal and state privacy law is heavily tested. The Gramm-Leach-Bliley Act (GLBA) is the federal floor for financial-institution privacy, implemented in insurance through the NAIC Privacy of Consumer Financial and Health Information Model Regulation. Two categories of protected data drive the rules:
- Nonpublic Personal Financial Information (NPI) — financial data a consumer provides, such as account numbers and income.
- Nonpublic Personal Health Information — medical and health data, which receives the strictest protection.
Notice and Opt-Out / Opt-In Rules
| Requirement | Rule |
|---|---|
| Initial privacy notice | Given at the time the customer relationship is established |
| Annual privacy notice | Generally provided each year the relationship continues |
| Financial info sharing with non-affiliates | Consumer must be given an opt-out right |
| Health information sharing | Generally requires affirmative opt-in (authorization) |
| Affiliate sharing | Often permitted with disclosure, narrower opt-out |
The exam loves the opt-out vs. opt-in distinction: financial data uses opt-out (sharing allowed unless the consumer says no), while health data generally requires opt-in (no sharing until the consumer affirmatively authorizes it).
Under the GLBA-based privacy framework, before an insurer may share a customer's nonpublic personal FINANCIAL information with a non-affiliated third party, it must generally:
Data Security and HIPAA Overlap
Beyond GLBA, the NAIC Insurance Data Security Model Law requires insurers and producers to maintain a written information security program, investigate cybersecurity events, and notify the regulator of qualifying data breaches. Health information that an insurer obtains can also implicate HIPAA, which protects individually identifiable health information and limits its use and disclosure.
The practical takeaway for producers is consistent across all these regimes: collect only the data needed, store it securely, share it only as authorized, and dispose of records properly. A breach of these duties is both a regulatory violation and a powerful source of consumer-trust damage.
The Fair Credit Reporting Act (FCRA)
When an insurer uses a consumer report (including a credit-based insurance score) or an investigative consumer report to underwrite, the Fair Credit Reporting Act (FCRA) applies. Key duties:
- The applicant must be notified that a report may be obtained.
- If the insurer takes an adverse action (declination, higher premium, reduced coverage) based wholly or partly on the report, it must give an adverse-action notice identifying the reporting agency and the applicant's right to a free copy and to dispute inaccuracies.
- Investigative consumer reports (interviews with neighbors/associates) require additional advance disclosure.
The exam trap: an adverse-action notice is required even when the report was only part of the reason for the decision.
Telemarketing and Electronic Contact
Consumer-protection rules also reach how producers solicit business. The federal Telephone Consumer Protection Act (TCPA) and the National Do-Not-Call Registry restrict unsolicited sales calls; a producer must scrub call lists against the registry and honor company-specific do-not-call requests. The CAN-SPAM Act governs commercial email, requiring a valid opt-out and accurate header and subject lines.
Calls and texts using automated dialing systems or prerecorded messages generally require prior consent. The exam frames these as extensions of the broader principle that solicitation must be honest, consented-to, and respectful of the consumer's stated preferences.
Insurance Fraud
Fraud is intentional deception for unlawful gain and is both a crime and a UTPA-adjacent concern. The exam distinguishes the players:
| Fraud Type | Actor | Example |
|---|---|---|
| Hard fraud | Claimant | Staging a theft or arson to collect |
| Soft fraud | Claimant | Padding a legitimate claim with extra damage |
| Producer fraud | Producer | Pocketing premiums, issuing fake binders |
| Insurer fraud | Company | Selling policies it cannot pay, false advertising |
The federal Fraud and False Statements provisions (18 U.S.C. §1033/§1034) make it a crime for anyone convicted of a felony involving dishonesty or breach of trust to work in insurance affecting interstate commerce without written consent from the regulator. Most states require insurers to maintain anti-fraud plans and to report suspected fraud, and they grant immunity to those who report fraud in good faith.
Consumer Protection Mechanisms
Beyond privacy and fraud rules, the regulatory system builds in consumer safeguards the exam expects you to recognize:
- Free-look period — a short window (commonly 10–30 days) to return a new policy for a full premium refund.
- Guaranty associations — state funds that pay covered claims, up to statutory caps, if an insurer becomes insolvent; producers may not advertise guaranty-fund coverage as a selling point.
- Grace period — time after a missed premium during which coverage continues.
- Required disclosures — replacement notices, coverage summaries, and clear policy language.
- Complaint and market-conduct oversight — the insurance department investigates consumer complaints and tracks complaint ratios.
Guaranty associations are funded by assessments on solvent insurers, not by taxpayers, and exist to protect policyholders, not the failed company's shareholders.
Worked example — free-look refund: A consumer pays a $1,200 annual premium, then returns the policy on day 12 of a 14-day free-look window. The insurer must refund the full $1,200 — the free-look refund is unconditional and is not prorated for the days the policy was in force, which separates it from an ordinary mid-term cancellation where only the unearned premium is returned.
An insurer declines an applicant partly because of a low credit-based insurance score drawn from a consumer report. Under the FCRA, the insurer MUST: